New Crypto-Mining Attacks Leverage NSA-Linked EternalBlue Exploit

A new version of the NRSMiner is actively spreading in the southern region of Asia. The majority of detections (54%) have been found in Vietnam, followed by Iran (16%) and Malaysia (12%). The new version either updates existing NRSMiner infections, or spreads to new systems using the EternalBlue exploit.

That EternalBlue is still being used to spread malware nearly two years after it was patched by Microsoft points to a massive failure in patching.

"Falling behind basic security practices, like patching, is usually the main culprit in these situations," Jarno Niemela, principal researcher ata F-Secure Labs told SecurityWeek. "And use of pirated software and how popular Windows is compared to other platforms are probably playing a role here."

However, he continued, "I think the biggest reason this is limited to certain countries has to do with resourcing. Security investments help ensure IT admins have time and money to create and maintain secure systems. And investments that build a culture of security is how those resources become allocated. Some parts of the world have invested in security education for decades, and we don't see this malware achieving the same prevalence in those regions."

The new version of NRSMiner is discussed by F-Secure researcher Neeraj Singh in a report published today. It updates existing infections by downloading new modules and deleting the files and services installed by its own previous versions. Existing infections with the wmassrv service running will connect to tecate[.]traduires[.]com to download an updater module.

The updater module checks to see if the new version is already installed. If it is, it deletes itself. If not, it downloads the malware from one of a series of hardcoded URLs. This malware performs the necessary housekeeping before installing a service named snmpstorsrv, with snmpstorsrv.dll registered as servicedll. It then deletes itself.

The new service creates multiple threads for different purposes, including the exfiltration of processor and system information, checking for a new module, and running the miner. The updated miner is injected into svchost.exe to start crypto-mining. If this fails, the miner is written to TrustedHostex.exe in the system32 folder and executed.

snmpstorsrv also decompresses a wininit.exe file and ejects it into svchost.exe. Failing this, wininit is written to \AppDiagnostics\wininit.exe and executed. Wininit is responsible for further propagation. One of the files it unzips and places in the AppDiagnostics folder is called svchost.exe but is actually the EternalBlue - 2.2.0 exploit executable.

Wininit.exe scans the local network on TCP port 445 looking for other accessible devices, and executes the EternalBlue exploit on any found and vulnerable systems. If successful, it installs the DoublePulsar backdoor on the new system. The new system is infected, and the process begins again.

The cryptominer used is the XMRig Monero CPU miner, employed to generate units of the Monero cryptocurrency. Monero has suffered the same decline in value experienced by all cryptocurrencies during 2018, peaking at around $542 in January 2018 and currently trading at less than $50. Nevertheless, it is gaining in popularity for both legitimate and illegitimate reasons.

On January 1, 2019, Monero tweeted, "The official Fortnite Merch Store is now exclusively accepting #Monero as a cryptocurrency payment option!" Fortnite is an online video game developed by Epic Games and released in July 2017. It reportedly has 125 million players throughout the world.

The bad guys simply like the increased privacy Monero provides over Bitcoin.

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.